How Engy (SN53) Tackles AI Inference Fraud With Cryptographic Verification

The AI inference market has a fraud problem few people talk about: Every time a customer pays for GPT-5.2 or GLM-5.2 through a third-party endpoint, they are trusting the provider to serve the requested model rather than quietly substituting it with a quantized version, a smaller sibling model, or another alternative.

Until now, there has been neither a scalable way to prove whether that substitution occurred, a forensic recourse when providers cheat, nor a way to catch them at scale. Engy (SN53), on Bittensor, addresses the problem with cryptographic verification delivered through an OpenAI-compatible API that works with existing developer tools like Claude Code, Cursor, and Codex.

How the Verification Actually Works

The proof pins the math rather than the machine, which sidesteps the trust assumptions built into TEE-based approaches.

1. Merkle-rooted weights and quantization. Each model’s exact configuration is published as a Merkle root that anyone can recompute from public checkpoints.

2. Miners commit to internal activations. Every inference run leaves a commitment auditors can challenge later.

3. Random audit sampling. Auditors pick random samples and require miners to open the commitment against the pinned weights.

4. Failed openings are proof of cheating. A miner running a quantized or substituted model cannot produce a valid opening, so cheating becomes structurally detectable rather than probabilistic.

5. No TEEs, no trusted hardware. The verification lives entirely in the math, meaning any consumer GPU can serve verified inference without specialized silicon.

The distinction matters because most verified inference approaches on other networks lean on Intel TDX or similar enclaves, which requires specific hardware and adds a layer of trust in the chip manufacturer. Engy’s approach removes that dependency.

Engy (SN53) vs Other Verified Inference on Bittensor

Verified inference is now a contested category on Bittensor. The three main approaches solve overlapping problems with structurally different trust models.

Subnet	Approach	Hardware Requirement	Model Coverage
Engy (SN53)	Cryptographic proof via Merkle roots and activation commitments	Any consumer GPU	Frontier open models (GLM-5.2, Qwen3.6-35B)
Targon (SN4)	Intel TDX secure enclaves	TDX-compatible CPUs plus Protected PCIe	Confidential compute across workloads
Nodexo (SN106)	Timed cryptographic challenges plus hardware fingerprints	Any GPU that passes proof	Verified hardware for general compute

The three subnets are complements rather than direct competitors: Targon (SN4) protects the workload from the operator through hardware isolation. Nodexo (SN106) verifies the physical machine is what it claims to be. Engy (SN53) verifies the specific model that produced each output through math the audit layer can recompute. Different customers with different threat models land on different answers.

Getting Started and Pricing

Engy (SN53) is OpenAI-compatible, which means integration with existing developer tools is a base URL change rather than a rewrite.

1. Claude Code: Add the Engy base URL and API key to ~/.claude/settings.json, keeping the model set to glm-5.2.

2. OpenAI API: Point the OpenAI client with the Engy API key.

3. Cursor: Override the OpenAI base URL in Cursor settings, add glm-5.2 as a custom model, and select it in chat. Requires a paid Cursor plan.

4. Codex: Add Engy as a model provider in ~/.codex/config.toml with the responses wire API.

5. Hermes: Add Engy as a custom provider in ~/.hermes/config.yaml.

Pricing runs per token with no subscriptions or minimums.

Model	Input $/1M	Output $/1M	Cached Input $/1M
GLM-5.2	$0.68	$1.50	$0.18
Qwen3.6-35B-A3B	$0.045	$0.30	$0.015

Prompt-cache hits the bill at the cached rate automatically with no configuration required. Agentic workloads like coding assistants and multi-turn tools typically hit 90%+ cache on repeated prefixes, so effective input cost usually lands far below the headline rate.

The Provider Fleet

Engy (SN53) is live with six providers across two models, with active demand routing across the fleet.

1. GLM-5.2. Served by a 32x RTX 5090 (32GB) provider.

2. Qwen3.6-35B-A3B. Served by five separate 8x RTX 4090 (48GB) providers.

3. All systems operational. The API gateway currently reports full uptime.

The consumer-GPU basis is intentional. Verified inference on RTX 4090s and 5090s puts the cost floor well below any hyperscaler serving equivalent open models, and the verification layer means renters get cryptographic assurance without paying for enterprise silicon.

Where Engy (SN53) Points

Verified inference is where AI infrastructure decides whether it can serve regulated and safety-sensitive workloads outside the closed frontier labs. Every organization that needs to know exactly which model produced a given output currently faces a choice between trusting an unverifiable closed API or running the model itself on owned hardware.

Engy (SN53) adds a third option that is verifiable and consumer-priced at the same time, which is a specific gap the open model ecosystem has not been able to close on centralized infrastructure. For teams building agent systems, coding assistants, or any workflow where inference cost meets model provenance, this is one of the sharper primitives Bittensor has produced this year.

➛ Explore Engy (SN53)’s Ecosystem Here